TN THE CLAIMS 



Amended claims follow: 

1 . (Currently Amended) A method for recognizing virus signatures, comprising 

(a) identifying a list of virus signatures; 

(b) combining the list of virus signatures into a tree of virus signatures; and 

(c) comparing data against the tree of virus signatures for virus signature 
recognition! 

wherein the virus signatures each include a sequence of characters; 

wherein the tree includes a plurality of branches each including a s equence of 

characters; 

wherein a portion of the brajiches corresponds to a plura lity of the virus 
signatures; 

wherein the efficiency of the virus signature recognition is improved by 
reducing an amount of virus signature data that is compared against the data; 
wherein the branches include further sub-branches each corresponding to at least 
one virus signature; 

wherein the branches include upper branch portions and lower branch portions . 

2. -6. (Cancelled) 

7. (Currently Amended) The method as recited in claim 41, wherein the characters 
include wildcards. 

8. (Currently Amended) The method as recited in claim 41, wherein the characters 
of the tree of virus signatures are obfuscated to prevent detection by the 
comparison. 
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9. (Cancelled) 

1 0. (Currently Amended) The method as recited in claim 9i, wherein the comparing 
includes comparing the data against the upper branch portions of the tree. 

1 1 . (Original) The method as recited in claim 10, wherein the comparing further 
includes comparing the data against the lower branch portions of the tree if the 
data was successfully compared to the upper branch portions associated with the 
lower branch portions. 

12. (Original) The method as recited in claim 1 1 , wherein a virus signature is 
determined to be recognized upon the successful comparison of the data against 
an entirety of at least one branch that includes all of the characters of one of the 
virus signatures, 

1 3. (Original) The method as recited in claim 1 1 , wherein data is eligible to be 
declared clean upon the unsuccessful comparison of the data against an entirety 
of at least one branch that includes all of the characters of one of the virus 
signatures. 

1 4. (Currently Amended) A computer program product embodied on a computer 
readable medium for recognizing virus signatures, comprising 

(a) computer code for identifying a list of virus signatures; 

(b) computer code for combining the list of virus signatures into a tree of virus 
signatures; and 

(c) computer code for comparing data against the tree of virus signatures for virus 
signature recognition; 

wherein the virus signatures each include a sequence of characters: 
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wherein the tree includes a plur ality of branches each tnchidini^ a sequence of 
charficters; 

wherein a portion of the branches con esponds to a plurality of the virus 
signatures; 

wherein the efficiency of the virus signature recognition is improved by 
reducing an amount of virus signature data that is compared against the data: 
wherein the branches include further sub-branches each corresponding to at least 
one virus signature: 

wherein the branches include upper branch portions and lov^er branch portions . 
15.-19. (Cancelled) 

20. (Currently Amended) The computer program product as recited in claim 174, 
wherein the characters include wildcards. 

21. (Currently Amended) The computer program product as recited in claim 174, 
wherein the characters of the tree of vims signatures are obfuscated to prevent 
detection by the comparison, 

22. (Cancelled) 

23. (Currently Amended) The computer program product as recited in claim 3314. 
wherein the comparing includes comparing the data against the upper branch 
portions of the tree. 

24. (Original) The computer program product as recited in claim 23, wherein the 
comparing further includes comparing the data against the lower branch portions 
of the tree if the data was successfully compared to the upper branch portions 
associated with the lower branch portions. 
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25. (Original) The computer program product as recited in claim 24, wherein a virus 
signature is detennined to be recognized upon the successful comparison of the 
data against an entirety of at least one branch that includes all of the characters 
of one of the virus signatures. 

26. (Original) The computer program product as recited in claim 24, wherein data is 
eligible to be declared clean upon the unsuccessful comparison of the data 
against an entirety of at least one branch that includes all of the characters of one 
of the virus signatures. 

27. (Currently Amended) A system for recognizing virus signatures, comprising 

(a) logic for identifying a list of virus signatures; 

(b) logic for combining the list of vims signatures into a tree of virus signatures; and 

(c) logic for comparing data against the tree of virus signatures for virus signature 
recognition; 

wherein the vims signatures each include a sequence of characters: 

wherein the tree includes a plurality of branches each including a sequence of 

characters; 

wherein a portion of the branches corresponds to a plurality of the vims 
signatures: 

wherein the efficiency of the virus signature recognition is improved by 
reducing an amount of vims signature data that is compared against the data: 
wherein the branches include further sub-branches each corresponding to at least 
one vims signature: 

wherein the branches include upper branch portions and lower branch portions . 

28. (Currently Amended) A method for recognizing vims signatures with improved 
efficiency, comprising 

(a) identifying a list of vims signatures each including a sequence of characters; 
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(b) 



(f) 



combming Ihe list of vims signatures into a tree of vims signatures including a 
plurality of branches each including a sequence of characters, wherein at least a 
portion of the branches inchides upper branch portions and lower branch 
portions; 

(c) obfuscating the sequence of characters in the tree of virus signatures; 

(d) comparing the data against the upper branch portions of the tree; 

(e) comparing the data against the lower branch portions of the tree if the data was 
successfully compared to the upper branch portions associated with the lower 
branch portions; 

declaring a vims signature to be recognized upon the successful comparison of 
the data against an entirety of at least one branch of the tree that includes all of 
the characters of one of the vims signatures; and 
(g) determining that the data is eligible to be declared clean upon the unsuccessful 
comparison of the data against an entirety of at least one branch of the tree that 
includes all of the characters of one of the vims signaturesi 
wherein a nortion of the branches r nrresponds to a nlurality of the vims 
si matures: 

whp.rfiin the efficiftncv of the virus signatu re recognition is improved by 
r^.HnrinP an amo unt of vims signature data that is compare d against the data; 
wherein the branches include furt h er sub-branches each conrespondin^ to at least 
one vims signature . 

29. (New) The method as recited in claim 8, wherein the obfuscation prevents 
accidental self-detection of the tree of virus signatures. 

30. (New) The method as recited in claim 29, wherein the obfuscation is 
accomplished utilizing an exclusive-OR operation. 
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(New) The method as recited in claim 1, wherein pre-processing is performed 
prior to use of the tree of virus signatures. 

(New) Tlie method as recited in claim 31, wherein the pre-processing includes 
finding a correct location in a file where a virus resides, decryption, and 
emulation. 

(New) The method as recited in claim 1, wherein the virus signature recognition 
is improved since comparison of similar portions of the virus signatures with the 
data more than once is avoided. 

(New) The method as recited in claim 1, wherein a pointer associated with a 
node of the tree is removed, if only one pointer exists, and an internal data ' 
structure includes a flag to indicate such removal. 
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